SUMMARY: Knowing who, when, and what needs a Client Access License (CAL) is a great question and one our team answers often. Under most scenarios, CAL requirements are generally straight forward, however, there are several specific scenarios which we address below. In this Licensing How To post, we cover the basics of Client Access Licensing, and recap a few common scenarios which may apply to you.
The Licensing How To series posts are provided by our Customer Service Presales and Licensing team members. These scenario based licensing topics are written on trending topics and issues based on their interactions with customers, Partners, and field sellers. For more posts from the Licensing How To series, search the “Licensing How To” tag on this blog.
It’s a question we answer daily, “I have scenario X, Y, or Z. Do I need a CAL?” Server software licensed via the Server / CAL licensing model always requires some sort of server license (which may be per instance or per processor depending on the Product) as well Client Access Licenses (CALs) for users and/or devices to access the server software. However, the question of who or what needs a CAL, along with any noted exceptions, varies by product.
The general requirement is, any User or Device that accesses the server software, either directly or indirectly, requires a CAL. Depending on the product and functionality being accessed, additive CALs may be required as well.
External users* (users who are not employees, onsite contractors, or onsite agents) can be licensed with CALs, External Connector licenses, and in some cases (SharePoint 2013, Lync 2013 or Exchange 2013) – external user access is granted with the Server License.
Access requirements vary by Product and you need to evaluate the requirements for each product you use. We encourage you to review the Product Use Rights, or Microsoft Software License Terms, that are applicable to you, and the products you use.
Here are a CAL questions that we answer frequently and we thought sharing them might help you when you think about your own CAL requirements. Please note that the below scenarios are based on licensing for the Server / CAL products currently available as of the date of publishing of this post.
Top CAL Questions
1 – Does my Multifunction Printer need a CAL?
Yes, if the multifunction printer is connected to a Windows Server network. A multifunction printer accesses server software to; receive an IP address, to receive a job, to communicate that the job is finished, etc. In short, it communicates with the server software. If the multifunction printer is accessing any server software licensed via the Server / CAL licensing model it requires a CAL for that software. The one caveat is, if your users who use the printer have CALs then the printer is covered by their use via their CALs. If not then the printer itself requires a device CAL. The same CAL requirement applies to any other type of networked device – such as networked scanners, networked fax machines, etc. Devices that do not connect to the network or the server software (generally referred to as peripherals) do not require CALs.
2 – Do my servers need a CAL?
Generally speaking – server to server communication does not require a CAL. However, servers used to pool connections (sometimes referred to as multiplexing) does not reduce your CAL licensing requirements. If, for example, you have an application server which uses SQL Server for its database – users of the application (or the devices they use) will need a SQL CAL even though they may not access the SQL Server directly. If you use a Linux server to run a web server, but your users accessing the web server are being authenticated via Windows Server – users (or the devices they use) will need a Windows Server CAL.
3 – Do my external users need a CAL?
The general rule is all server software access requires a CAL. However, external users* may have additional licensing options depending on the product. For example, with Windows Server – external users can be licensed with CALs or External Connectors (whichever is more cost effective). External user access to application servers such as SharePoint 2013, Lync 2013, and Exchange 2013 is included with the server software – CALs or External Connectors are not required for external users for these products. Note: external users will need to be licensed appropriately for the underlying Windows Server operating system and related software such as SQL.
4 – Do I need an RDS CAL?
There are two basic scenarios which trigger the requirement for an RDS CAL.
Your users or devices directly or indirectly access any of the RDS product functionality, and/or
Your users of devices directly or indirectly interact with the graphical user interface of the server software using RDS functionality or other third party technology (e.g. Citrix, GraphOn, 2X to name a few)
If you meet either (or both) of the points described above – an RDS CAL is required. It is also worth pointing out that point 2 above implies that RDS CALs are required when Windows Server is used to host any type of VDI solution (session based or otherwise).
5 – Do I need a CAL when my Windows Server is used to run a web server?
Windows Server 2012 R2 configured to run Web Workloads** do not require CALs or External Connectors. Web workloads, also referred to as an internet web solution, are publically accessible (e.g. accessible outside of the firewall) and consist only of web pages, web sites, web applications, web services, and/or POP3 mail serving. Access to content, information, and/or applications within the internet web solution must be publically accessible. In other words, they cannot be restricted to you or your affiliate’s employees. Also whether you are running a “web workload” or not – if users exchange personally identifiable information, or are otherwise individually identifiable (or the users are authenticated via a Microsoft or third party product) – CALs or External Connector licenses will be required to access the Windows Server(s) used to authenticate/identify users.
The end result? If you have Windows Servers configured to run a “web workload” and your users are not being individually identified or authenticated in any way – these users will not require CALs or External Connectors. However, let’s say you are using Windows Server to setup an online store where customers can buy widgets. You have front end Windows Servers setup to support your website, and backend servers (e.g. commerce servers) setup so customers can check out and buy your widgets. The front end servers used to host your website would generally be considered as running “web workloads” and CALs or External Connectors will not be required to access these servers. Once the customer adds a widget to their shopping cart, creates an account and enters their credit card and shipping information to complete the sale – they are now authenticated via your commerce servers/application. Since users are being authenticated (or individually identified) via the backend commerce servers – CALs or External Connectors will be required for the users of these servers.
6 – Can I use my CALs to access someone else’s server?
You may use CALs purchased by your company to access your servers, or servers owned by your Affiliates*** only. You may not use your CALs to access servers owned by an un-affiliated third party. Let’s say for example, that Company A and Company B are affiliates. Company A wants to provide employees from Company B with access to their SharePoint Servers. However, Company B already owns Windows Server and SharePoint Server CALs (that match the version of Windows and SharePoint Server that Company A uses). Company A will not need to purchase additional Windows Server or SharePoint Server CALs since employees from their affiliate, Company B, are already covered with the appropriate CALs. If we use the same scenario as above, but assume Company A and B are not affiliated - then CALs owned by B cannot be used to access Company A’s servers. Company A would need to appropriately license their SharePoint farm for external users.
7 – Do I need CALs for my administrators?
Server software licensed using CALs permits up to 2 users or devices to access the server software for the purposes of administration without CALs. However, if your administrators also use the software for anything other than administration (for example, they check their email), CALs will be required for them as well.
For additional information on CAL requirements, consult your Product Use Rights, License Terms, or contact your Reseller, Microsoft Partner, or Account Team. Many products have licensing guides on the Volume License Website and/or their respective product sites. Here are a few of our favorite resources on the subject.
Multiplexing - Client Access License (CAL) Requirements
Base and Additive Client Access Licenses: An Explanation
Licensing Windows Server 2012 R2 Remote Desktop Services
About Licensing – Client Access Licenses and Management Licenses
* External Users means users that are not either your or your affiliates’ employees, or your or your affiliates’ onsite contractors or onsite agents.
** Web Workloads (also referred to as “Internet Web Solutions”) are publicly accessible and consist solely of web pages, websites, web applications, web services, and/or POP3 mail serving. For clarity, access to content, information, and applications served by the software within an Internet Web Solution is not limited to your or your affiliates’ employees.
Software in Internet Web Solutions is used to run:
web server software (for example, Microsoft Internet Information Services), and management or security agents (for example, the System Center Operations Manager agent).
database engine software (for example, Microsoft SQL Server) solely to support Internet Web Solutions.
the Domain Name System (DNS) service to provide resolution of Internet names to IP addresses as long as that is not the sole function of that instance of the software.
***“Affiliate” means any legal entity that a party owns, that owns a party, or that is under common ownership with a party. “Ownership” means, for purposes of this definition, control of more than a 50% interest in an entity.
This is one scenario and licensing situation. Each customer scenario can vary by deployment, usage, product version, and product use rights. Always check your contract, and the current Products Use Rights document to confirm how your environment should be fully licensed. The blogging team does not warrant that this scenario will be the right licensing solution for other similar cases.